Windows slooow, problems opening, closing down

Hii

Lately my Windows have worked erratically. Won't open or takes forever, same problem with closing down.

It freezes and doesn't respond etc. etc.

I include logfile for MBR - done in safe mode, as I couldn't get through a scan any other way. The Farbar scan is done in

normal mode.

Thanks

Jens

MBR:

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-11-01 13:36:44
—————————–
13:36:44.841    OS Version: Windows x64 6.1.7601 Service Pack 1
13:36:44.841    Number of processors: 2 586 0x2A07
13:36:44.841    ComputerName: SHEANA-PC  UserName: Sheana
13:36:46.525    Initialize success
13:52:51.886    AVAST engine defs: 17030301
13:55:45.827    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:55:45.842    Disk 0 Vendor: TOSHIBA_MQ01ABF050 AM0P1A Size: 476940MB BusType: 11
13:55:46.201    Disk 0 MBR read successfully
13:55:46.217    Disk 0 MBR scan
13:55:46.232    Disk 0 Windows 7 default MBR code
13:55:46.248    Disk 0 Partition 1 00     07    HPFS/NTFS NTFS       199900 MB offset 206848
13:55:46.263    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 409602048
13:55:46.279    Disk 0 Boot: NTFS     code=1
13:55:46.310    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       276838 MB offset 409806848
13:55:46.373    Disk 0 scanning C:\Windows\system32\drivers
13:55:54.563    Service scanning
13:56:18.571    Modules scanning
13:56:18.571    Disk 0 trace - called modules:
13:56:19.102    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
13:56:19.102    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c94760]
13:56:19.102    3 CLASSPNP.SYS[fffff8800199843f] -> nt!IofCallDriver -> [0xfffffa80047392c0]
13:56:19.117    5 ACPI.sys[fffff88000fa07a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004752060]
13:56:19.866    AVAST engine scan C:\Windows
13:56:21.691    AVAST engine scan C:\Windows\system32
13:58:38.113    AVAST engine scan C:\Windows\system32\drivers
13:58:47.395    AVAST engine scan C:\Users\Sheana
14:11:26.868    AVAST engine scan C:\ProgramData
14:11:52.218    Disk 0 statistics 3833333/0/0 @ 2.50 MB/s
14:11:52.218    Scan finished successfully
14:16:22.084    Disk 0 MBR has been saved successfully to "C:\Users\Sheana\Desktop\MBR.dat"
14:16:22.084    The log file has been saved successfully to "C:\Users\Sheana\Desktop\aswMBR.txt"

Farbar:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-11-2017
Ran by [removed] (administrator) on SHEANA-PC (01-11-2017 15:43:45)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\avgui.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.2\ToolbarUpdater.exe
() C:\Program Files (x86)\SaferVPN\SaferVPN.exe
(Spotify Ltd) C:\Users\Sheana\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16776704 2016-12-15] (Realtek Semiconductor)
HKLM\…\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-10-06] (AVG Technologies CZ, s.r.o.)
HKLM\…\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [289248 2017-09-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\…\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-10-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [2162760 2016-07-21] ()
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3135081951-948255948-2762818755-1000\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27427808 2017-02-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3135081951-948255948-2762818755-1000\…\Run: [Spotify] => C:\Users\Sheana\AppData\Roaming\Spotify\Spotify.exe [21093488 2017-10-25] (Spotify Ltd)
HKU\S-1-5-21-3135081951-948255948-2762818755-1000\…\Run: [SaferVPN] => C:\Program Files (x86)\SaferVPN\SaferVPN.exe [10012592 2017-06-27] ()
HKU\S-1-5-21-3135081951-948255948-2762818755-1000\…\Run: [Spotify Web Helper] => C:\Users\Sheana\AppData\Roaming\Spotify\SpotifyWebHelper.exe [777840 2017-10-25] (Spotify Ltd)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{05F01782-356A-4E6E-A8A7-5D782C0D6C0F}: [DhcpNameServer] [removed] [removed]

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3135081951-948255948-2762818755-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={142A452D-A6FB-4046-AEBD-5ADAE7D5FA4C}&mid=fe48c534f63a47cc8440c1f60ee37f09-6f57c1b4b7f5c8ca2783c1861d5d09e2fa86a60f&lang=en&ds=ZEN&coid=avgtbdisZE&cmpid=0616tb&pr=fr&d=2016-03-28 11:05:22&v=4.3.1.831&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-19] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.3.2.18\AVG Web TuneUp.dll [2016-07-21] (AVG)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-19] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: 5ndobl67.default
FF ProfilePath: C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\5ndobl67.default [2017-11-01]
FF Homepage: Mozilla\Firefox\Profiles\5ndobl67.default -> hxxps://www.ixquick.eu/
FF Extension: (Search Shield Study) - C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\5ndobl67.default\Extensions\@unified-urlbar-shield-study-opt-out-new-users.xpi [2017-10-12]
FF Extension: (Safe Browsing Version 4 (temporary add-on)) - C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\5ndobl67.default\Extensions\[removed] [2017-10-12]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll [2017-08-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll [2017-08-23] ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.3.2\\npsitesafety.dll [No File]
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.co.uk/?gws_rd=ssl
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/?gws_rd=ssl"
CHR Profile: C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default [2016-03-30]
CHR Extension: (Google Slides) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-01-22]
CHR Extension: (Google Docs) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-01-21]
CHR Extension: (Google Drive) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-21]
CHR Extension: (YouTube) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-21]
CHR Extension: (Google Search) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-21]
CHR Extension: (Google Sheets) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-01-21]
CHR Extension: (Google Docs Offline) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-01-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-01-21]
CHR Extension: (Gmail) - C:\Users\Sheana\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-21]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [276328 2017-09-07] (AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7502936 2017-09-07] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1428656 2017-10-06] (AVG Technologies CZ, s.r.o.)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S2 SaferVPN.Service; C:\Program Files (x86)\SaferVPN\SaferVPN.Service.exe [2547120 2017-06-27] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
R2 vToolbarUpdater40.3.2; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.2\ToolbarUpdater.exe [1309768 2016-07-21] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [976456 2016-07-21] ()

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 avgbdisk; C:\Windows\system32\drivers\avgbdiska.sys [166624 2017-09-07] (AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\Windows\system32\drivers\avgbidsdrivera.sys [314128 2017-09-07] (AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\Windows\system32\drivers\avgbidsha.sys [192584 2017-09-07] (AVG Technologies CZ, s.r.o.)
R0 avgblog; C:\Windows\system32\drivers\avgbloga.sys [336896 2017-09-07] (AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\Windows\system32\drivers\avgbuniva.sys [51336 2017-09-07] (AVG Technologies CZ, s.r.o.)
S3 avgHwid; C:\Windows\system32\drivers\avgHwid.sys [39424 2017-09-07] (AVG Technologies CZ, s.r.o.)
R2 avgMonFlt; C:\Windows\system32\drivers\avgMonFlt.sys [140192 2017-09-07] (AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\Windows\system32\drivers\avgRvrt.sys [76832 2017-09-07] (AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\Windows\system32\drivers\avgSnx.sys [1008800 2017-09-07] (AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\Windows\system32\drivers\avgSP.sys [583288 2017-09-07] (AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\Windows\system32\drivers\avgVmm.sys [355856 2017-09-25] (AVG Technologies CZ, s.r.o.)
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [88104 2012-03-08] (Broadcom Corporation)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [178216 2012-02-22] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [539176 2012-02-22] (Broadcom Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [110744 2012-07-19] (Qualcomm Atheros Co., Ltd.)
R3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [2473616 2014-12-10] (MediaTek Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-01 18:11 - 2017-11-01 18:11 - 000000000 __SHD C:\found.001
2017-11-01 15:43 - 2017-11-01 15:44 - 000013173 _____ C:\Users\Sheana\Desktop\FRST.txt
2017-11-01 14:39 - 2017-11-01 14:40 - 000000000 ____D C:\Users\Sheana\Desktop\Farbarsafe
2017-11-01 14:39 - 2017-11-01 14:39 - 000000000 ____D C:\Users\Sheana\Desktop\aswsafe
2017-11-01 13:35 - 2017-11-01 13:36 - 000063574 _____ C:\Windows\ntbtlog.txt
2017-11-01 13:24 - 2017-11-01 13:25 - 002403328 _____ (Farbar) C:\Users\Sheana\Desktop\FRST64.exe
2017-11-01 13:19 - 2017-11-01 13:19 - 005198336 _____ (AVAST Software) C:\Users\Sheana\Desktop\aswMBR.exe
2017-10-25 21:33 - 2017-10-25 21:33 - 000000000 __SHD C:\found.000
2017-10-18 14:39 - 2017-10-18 14:39 - 000262144 _____ C:\Windows\Minidump\101817-17503-01.dmp
2017-10-12 11:03 - 2017-10-12 11:03 - 000262144 _____ C:\Windows\Minidump\101217-28298-01.dmp
2017-10-12 11:00 - 2017-10-12 11:00 - 000000000 ____D C:\Users\Sheana\Desktop\Old Firefox Data
2017-10-12 10:57 - 2017-10-12 10:58 - 000245816 _____ (Mozilla) C:\Users\Sheana\Downloads\Firefox Installer.exe
2017-10-12 10:29 - 2017-10-12 10:29 - 000262144 _____ C:\Windows\Minidump\101217-29686-01.dmp
2017-10-08 01:08 - 2017-10-18 14:39 - 000000000 ____D C:\Windows\Minidump
2017-10-08 01:08 - 2017-10-08 01:08 - 000262144 _____ C:\Windows\Minidump\100817-28813-01.dmp
2017-10-08 01:07 - 2017-10-18 14:39 - 463756660 _____ C:\Windows\MEMORY.DMP

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-01 15:43 - 2016-08-21 09:52 - 000000000 ____D C:\FRST
2017-11-01 15:42 - 2009-07-14 05:45 - 000021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-01 15:42 - 2009-07-14 05:45 - 000021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-01 15:39 - 2016-11-18 10:14 - 000000000 ____D C:\Users\Sheana\AppData\LocalLow\Mozilla
2017-11-01 15:38 - 2016-01-23 10:30 - 000000000 ____D C:\Users\Sheana\AppData\Roaming\Spotify
2017-11-01 15:37 - 2016-01-23 10:59 - 000000000 ____D C:\Users\Sheana\AppData\Roaming\Skype
2017-11-01 15:36 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-01 14:30 - 2009-07-14 06:13 - 000785366 _____ C:\Windows\system32\PerfStringBackup.INI
2017-11-01 14:30 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2017-11-01 14:29 - 2017-09-27 22:14 - 000000000 _____ C:\Windows\SysWOW64\last.dump
2017-11-01 14:29 - 2016-01-23 10:34 - 000000000 ____D C:\Users\Sheana\AppData\Local\Spotify
2017-11-01 14:22 - 2009-07-14 06:08 - 000032588 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-10-31 22:34 - 2016-09-21 10:37 - 000003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-10-29 22:17 - 2016-01-21 19:34 - 000000000 ____D C:\Users\Sheana\AppData\Roaming\vlc
2017-10-27 10:42 - 2016-01-22 12:16 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-10-27 07:33 - 2016-11-18 00:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-10-21 23:05 - 2016-01-21 19:27 - 000000000 ____D C:\Users\Sheana
2017-10-19 17:58 - 2016-01-21 11:06 - 000000000 ____D C:\ProgramData\Oracle
2017-10-19 17:55 - 2016-01-21 11:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-19 17:55 - 2016-01-21 11:06 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-19 17:54 - 2016-01-21 11:07 - 000097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-10-13 13:53 - 2017-04-21 09:29 - 000004178 _____ C:\Windows\System32\Tasks\Antivirus Emergency Update
2017-10-12 10:37 - 2017-07-11 15:34 - 000000000 ____D C:\Program Files (x86)\SaferVPN
2017-10-12 10:37 - 2016-03-28 10:05 - 000000000 ____D C:\Program Files (x86)\AVG Web TuneUp
2017-10-12 10:37 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\registration
2017-10-12 10:37 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\IME
2017-10-08 18:13 - 2016-02-24 19:16 - 000000000 ____D C:\Users\Sheana\AppData\Local\ElevatedDiagnostics

Some files in TEMP:
====================
2017-08-07 10:18 - 2017-08-07 10:18 - 000003584 _____ () C:\Users\Sheana\AppData\Local\Temp\6uoxd74x.dll
2016-06-01 17:02 - 2016-04-22 09:01 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_081899836627.exe
2016-04-07 20:38 - 2016-02-18 12:09 - 000179624 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_081927674860.exe
2016-04-20 00:13 - 2016-03-23 15:57 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_08302635609.exe
2016-06-23 18:32 - 2016-05-18 12:03 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_08408051081.exe
2016-05-13 20:38 - 2016-04-14 16:29 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_08549593070.exe
2016-07-27 11:24 - 2016-06-21 17:49 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_08600366166.exe
2016-08-23 15:31 - 2016-07-20 13:01 - 000186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Sheana\AppData\Local\Temp\avguirn_08620128787.exe
2016-07-21 09:42 - 2016-07-21 09:42 - 000741440 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u101-windows-au.exe
2016-10-25 09:32 - 2016-10-25 09:32 - 000737856 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u111-windows-au.exe
2017-01-24 11:24 - 2017-01-24 11:24 - 000739904 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u121-windows-au.exe
2017-04-21 08:55 - 2017-04-21 08:55 - 000739904 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u131-windows-au.exe
2017-07-24 07:56 - 2017-07-24 07:56 - 000739904 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u141-windows-au.exe
2017-10-19 17:53 - 2017-10-19 17:53 - 001856576 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u151-windows-au.exe
2016-03-24 09:26 - 2016-03-24 09:26 - 000736320 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u77-windows-au.exe
2016-05-02 23:22 - 2016-05-02 23:22 - 000739904 _____ (Oracle Corporation) C:\Users\Sheana\AppData\Local\Temp\jre-8u91-windows-au.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-10-30 09:15

==================== End of FRST.txt ============================

Waiting to hear from you. Thanx

Jens


 

Oh, yeah I forgot it.

Here it is:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-11-2017
Ran by [removed] (01-11-2017 15:44:40)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2016-01-21 18:27:16)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3135081951-948255948-2762818755-500 - Administrator - Disabled)
Guest (S-1-5-21-3135081951-948255948-2762818755-501 - Limited - Disabled)
Sheana (S-1-5-21-3135081951-948255948-2762818755-1000 - Administrator - Enabled) => C:\Users\Sheana

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Antivirus (Enabled - Out of date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Antivirus (Enabled - Out of date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 26 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\…\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.4.0 - Asmedia Technology)
AVG (HKLM\…\{BA40B3B4-7707-437E-84FF-8C18BE5AD9B6}) (Version: 1.211.2 - AVG Technologies) Hidden
AVG 2016 (HKLM\…\{A1C2B71D-7DD1-4A1F-9B3C-9267CCFE9977}) (Version: 16.0.4568 - AVG Technologies) Hidden
AVG AntiVirus FREE (HKLM-x32\…\AVG Antivirus) (Version: 17.6.3029 - AVG Technologies)
AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.3.2.18 - AVG Technologies)
doPDF 7.2 printer (HKLM\…\doPDF 7 printer_is1) (Version:  - Softland)
FMW 1 (HKLM\…\{3F8A655C-2D4D-4BAC-8384-0E937CC137C8}) (Version: 1.225.1 - AVG Technologies) Hidden
HZ DDP Player (HKLM-x32\…\HZ DDP Player) (Version:  - Sonoris Audio Engineering)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2559 - Intel Corporation)
Java 8 Update 151 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
Microsoft .NET Framework 4.6.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 56.0.2 (x64 en-US) (HKLM\…\Mozilla Firefox 56.0.2 (x64 en-US)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 56.0.2.6506 - Mozilla)
MuseScore 2 (HKLM-x32\…\{4F0E15EA-F64C-11E5-9992-E717EA7DB0C8}) (Version: 2.0.3 - Werner Schweer and Others)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8018 - Realtek Semiconductor Corp.)
SaferVPN 4.0.1 (HKLM-x32\…\OpenVPN) (Version: 4.0.1 - )
Skype™ 7.32 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.32.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3135081951-948255948-2762818755-1000\…\Spotify) (Version: 1.0.66.478.g1296534d - Spotify AB)
TeamViewer 10 (HKLM-x32\…\TeamViewer) (Version: 10.0.47484 - TeamViewer)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\…\VLC media player) (Version: 2.1.3 - VideoLAN)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-19] (Igor Pavlov)
ContextMenuHandlers1: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVG\Antivirus\ashShA64.dll [2017-09-07] (AVG Technologies CZ, s.r.o.)
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-19] (Igor Pavlov)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2011-11-04] (Intel Corporation)
ContextMenuHandlers6: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVG\Antivirus\ashShA64.dll [2017-09-07] (AVG Technologies CZ, s.r.o.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {12E50C69-3CB6-4B4F-830F-255CC057798A} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2016-12-15] (Realtek Semiconductor)
Task: {23A2B083-1EDD-462C-B8BC-67AE241D86F2} - System32\Tasks\Antivirus Emergency Update => C:\Program Files (x86)\AVG\Antivirus\AvEmUpdate.exe [2017-09-07] (AVG Technologies CZ, s.r.o.)
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {4181EF81-3C3E-4CA8-9FB7-C8D9256198B4} - System32\Tasks\AVGPCTuneUp_Task_BkGndMaintenance => C:\Program Files (x86)\AVG\AVG PC TuneUp\tuscanx.exe
Task: {47E122AA-1B42-42B8-93D3-26BA22BA51E9} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {5A0AEBEF-E027-47E9-842C-7E14F11AA1A6} - System32\Tasks\AVG EUpdate Task => avgsetupx.exe
Task: {79C8FF37-5FAF-4CC4-8A1E-F91E61A11022} - System32\Tasks\0116avzUpdateInfo => C:\ProgramData\Avg_Update_0116avz\0116avz_AVG-Secure-Search-Update.exe
Task: {805CC98F-C591-41DF-AB27-6CCDACBEC9BB} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-09-05] (Oracle Corporation)
Task: {83DBB195-0AC0-41D2-BC14-C4EA9BAD4158} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {83DBB195-0AC0-41D2-BC14-C4EA9BAD4158} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshContent
Task: {83DBB195-0AC0-41D2-BC14-C4EA9BAD4158} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(3): C:\Windows\system32\GWX\GWXDetector.exe [2016-05-20] (Microsoft Corporation)
Task: {842EC8AE-7B8B-4FFA-ABA9-E263F435C3ED} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {8DB25474-BD79-40FD-B5DD-057044430F8D} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfigAndContent
Task: {8DB25474-BD79-40FD-B5DD-057044430F8D} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-05-20] (Microsoft Corporation)
Task: {9B52586B-2EEF-4353-BDD7-CD85C7E43D66} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-08-23] (Adobe Systems Incorporated)
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {B51B90A5-7735-4E89-ABF9-0A89C714B810} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {B51B90A5-7735-4E89-ABF9-0A89C714B810} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-05-20] (Microsoft Corporation)
Task: {B9436422-60AB-418C-8B2C-2F8920B24947} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {CBF0B5FE-50F8-4150-8BDD-0666A7D4431F} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2016-12-15] (Realtek Semiconductor)
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {E92476AA-2379-48E8-9F4C-E361CF0DEF63} - System32\Tasks\RtHDVBg_ListenToDevice => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2016-12-15] (Realtek Semiconductor)
Task: {F33022F4-330E-46AC-89CF-945CD4205C87} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe -> /ScheduleUpgradeReminderTime
Task: {F33022F4-330E-46AC-89CF-945CD4205C87} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-05-20] (Microsoft Corporation)
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-03-28 10:05 - 2016-07-21 18:59 - 000976456 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2016-01-21 10:58 - 2011-11-04 03:09 - 000094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2017-06-27 10:29 - 2017-06-27 10:29 - 010012592 _____ () C:\Program Files (x86)\SaferVPN\SaferVPN.exe
2017-09-07 20:07 - 2017-09-07 20:07 - 000068528 _____ () C:\Program Files (x86)\AVG\Antivirus\x64\module_lifetime.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000170952 _____ () c:\Program Files (x86)\AVG\Antivirus\x64\vaarclient.dll
2017-09-28 09:36 - 2017-09-28 09:36 - 000835344 _____ () C:\Program Files (x86)\AVG\Antivirus\x64\ffl2.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000287832 _____ () c:\Program Files (x86)\AVG\Antivirus\x64\StreamBack.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000060160 _____ () C:\Program Files (x86)\AVG\Antivirus\module_lifetime.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000168216 _____ () C:\Program Files (x86)\AVG\Antivirus\JsonRpcServer.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000213024 _____ () C:\Program Files (x86)\AVG\Antivirus\event_routing_rpc.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000243080 _____ () C:\Program Files (x86)\AVG\Antivirus\tasks_core.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000150688 _____ () C:\Program Files (x86)\AVG\Antivirus\network_notifications.dll
2017-10-11 18:04 - 2017-10-11 18:04 - 005876576 _____ () C:\Program Files (x86)\AVG\Antivirus\defs\17101102\algo.dll
2017-09-28 09:36 - 2017-09-28 09:36 - 000693528 _____ () C:\Program Files (x86)\AVG\Antivirus\ffl2.dll
2017-09-07 20:07 - 2017-09-07 20:07 - 000242568 _____ () C:\Program Files (x86)\AVG\Antivirus\streamback.dll
2016-11-28 12:43 - 2016-11-28 12:42 - 048920064 _____ () C:\Program Files (x86)\AVG\UiDll\2623\libcef.dll
2017-07-05 08:14 - 2017-07-05 08:14 - 067109376 _____ () C:\Program Files (x86)\AVG\Antivirus\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2017-01-07 17:34 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3135081951-948255948-2762818755-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sheana\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{CAE3E590-1A56-4FB5-921F-740876D3993B}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{2A4ED2D3-F733-47EF-91EF-00D35884DCF5}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{567D9D82-365D-4390-A528-4945C9D667A1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7DF1F4CA-2470-4A18-A9C4-12F0D63F8594}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E0CBB21C-F436-4CDE-8C3F-FF83548696B3}C:\users\sheana\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sheana\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BBEFA09D-53C3-4D27-8672-520CB59D7C3B}C:\users\sheana\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sheana\appdata\roaming\spotify\spotify.exe
FirewallRules: [{8ACECEA7-BF18-4F44-96BA-F19E16549D79}] => (Block) C:\users\sheana\appdata\roaming\spotify\spotify.exe
FirewallRules: [{9881CA47-E562-4E64-9872-DD50F23192CF}] => (Block) C:\users\sheana\appdata\roaming\spotify\spotify.exe
FirewallRules: [{887C498C-B225-4568-976E-3A512465E342}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{F43F98A3-2304-439C-A6AE-C1E331E9AC09}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{E7BF31DE-B450-4854-BB62-D31F4CB147AE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{2BEFB6DB-A1B9-4A41-8AB1-CBDD2171E1F8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{44423604-F800-47E8-BB4B-5BEDCFEDED2F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{EF9206AA-EF3D-4CBE-9B82-EC483BECB717}] => (Allow) C:\ProgramFiles(x86)\SaferVPN\SaferVPN.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/01/2017 03:42:44 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\AVG\Antivirus\defs\17110100\aswEngin.dll".
Dependent Assembly Avast.VC140.CRT,processorArchitecture="x86",publicKeyToken="fcc99ee6193ebbca",type="win32",version="14.0.23918.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (11/01/2017 03:38:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/01/2017 03:32:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program aswMBR.exe version 1.0.1.2252 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: dd0

Start Time: 01d35316be33eb32

Termination Time: 0

Application Path: C:\Users\Sheana\Desktop\aswMBR.exe

Report Id: 6cd76b45-bf10-11e7-a500-10bf480796fa

Error: (11/01/2017 02:33:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Skype.exe version 7.32.0.104 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: a2c

Start Time: 01d35314907c99c3

Termination Time: 13

Application Path: C:\Program Files (x86)\Skype\Phone\Skype.exe

Report Id:

Error: (11/01/2017 02:29:57 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\AVG\Antivirus\defs\17110100\aswEngin.dll".
Dependent Assembly Avast.VC140.CRT,processorArchitecture="x86",publicKeyToken="fcc99ee6193ebbca",type="win32",version="14.0.23918.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (11/01/2017 02:29:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SaferVPN.exe, version: 4.0.1.0, time stamp: 0x595215ef
Faulting module name: clr.dll, version: 4.6.1076.0, time stamp: 0x56d7a0ff
Exception code: 0x80131506
Fault offset: 0x0026d804
Faulting process id: 0xa3c
Faulting application start time: 0x01d353149083bde3
Faulting application path: C:\Program Files (x86)\SaferVPN\SaferVPN.exe
Faulting module path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
Report Id: b35aeafc-bf08-11e7-a500-10bf480796fa

Error: (11/01/2017 02:27:23 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Application: SaferVPN.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an internal error in the .NET Runtime at IP 734DD804 (73270000) with exit code 80131506.

Error: (11/01/2017 02:26:10 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\AVG\Antivirus\defs\17110100\aswEngin.dll".
Dependent Assembly Avast.VC140.CRT,processorArchitecture="x86",publicKeyToken="fcc99ee6193ebbca",type="win32",version="14.0.23918.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (11/01/2017 02:24:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (11/01/2017 01:37:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (11/01/2017 03:42:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SaferVPN.Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (11/01/2017 03:42:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the SaferVPN.Service service to connect.

Error: (11/01/2017 03:41:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.

Error: (11/01/2017 03:40:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (11/01/2017 03:39:12 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort0.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU B950 @ 2.10GHz
Percentage of memory in use: 51%
Total physical RAM: 4000.13 MB
Available physical RAM: 1956.61 MB
Total Virtual: 7998.43 MB
Available Virtual: 5875.74 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:270.35 GB) (Free:134.71 GB) NTFS
Drive d: (DATA) (Fixed) (Total:195.21 GB) (Free:99.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 493C1F0B)
Partition 1: (Not Active) - (Size=195.2 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=270.3 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Hi

Here is the fixlog

- I made a mistake, though, as I forgot to put the text in the search field first time.

I then ran it again with the text.

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-11-2017
Ran by [removed] (02-11-2017 21:33:42) Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3135081951-948255948-2762818755-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={142A452D-A6FB-4046-AEBD-5ADAE7D5FA4C}&mid=fe48c534f63a47cc8440c1f60ee37f09-6f57c1b4b7f5c8ca2783c1861d5d09e2fa86a60f&lang=en&ds=ZEN&coid=avgtbdisZE&cmpid=0616tb&pr=fr&d=2016-03-28 11:05:22&v=4.3.1.831&pid=wtu&sg=&sap=dsp&q={searchTerms}
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {47E122AA-1B42-42B8-93D3-26BA22BA51E9} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {B9436422-60AB-418C-8B2C-2F8920B24947} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
Hosts:
Emptytemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset

*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => key removed successfully
HKU\S-1-5-21-3135081951-948255948-2762818755-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => key not found.
HKLM\Software\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg => key not found.
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found.
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\00avg => key not found.
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsBackup\ConfigNotification => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{47E122AA-1B42-42B8-93D3-26BA22BA51E9} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC4E5ACF-89F7-4220-BA21-81EE183975E2} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\AitAgent => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9436422-60AB-418C-8B2C-2F8920B24947} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTask => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector => key not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

There's no user specified settings to be reset.


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 12582912 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3235752 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
Sheana => 331805 B

RecycleBin => 0 B
EmptyTemp: => 15.4 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 21:35:08 ====

I got through a complete scan with Malwarebytes, then an error occurred, and I ad to

close the program. I can run it in safe mode, is that any good? The same question applies

potentially to ADWcleaner.

JRT have stopped pr. end of October, so I couldn't download it.

Jens

OK

I post the two files done in safe mode:

MBW:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/3/17
Scan Time: 8:23 AM
Log File: e91e78b5-c067-11e7-a283-00ff70a9d2c9.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3162
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sheana-PC\Sheana

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 336611
Threats Detected: 3
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 11 min, 18 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
PUP.Optional.Proinstall, C:\USERS\SHEANA\DOWNLOADS\SPOTIFYSETUP-39223635.EXE, No Action By User, [5913], [65195],1.0.3162
PUP.Optional.Reimage, C:\USERS\SHEANA\DOWNLOADS\REIMAGEREPAIR.EXE, No Action By User, [1070], [331559],1.0.3162
PUP.Optional.Reimage, C:\USERS\SHEANA\DOWNLOADS\REIMAGEREPAIR(1).EXE, No Action By User, [1070], [331559],1.0.3162

Physical Sector: 0
(No malicious items detected)


(end)

ADWCleaner:

# AdwCleaner 7.0.4.0 - Logfile created on Fri Nov 03 08:04:45 2017
# Updated on 2017/27/10 by Malwarebytes
# Running on Windows 7 Home Premium (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

Deleted: WtuSystemSupport
Deleted: vToolbarUpdater40.3.2


***** [ Folders ] *****

Deleted: C:\ProgramData\AVG Secure Search
Deleted: C:\ProgramData\Application Data\AVG Secure Search
Deleted: C:\Program Files\Common Files\AVG Secure Search
Deleted: C:\Program Files (x86)\Common Files\AVG Secure Search
Deleted: C:\Users\All Users\AVG Secure Search
Deleted: C:\ProgramData\avg web tuneup
Deleted: C:\ProgramData\Application Data\avg web tuneup
Deleted: C:\Program Files (x86)\avg web tuneup
Deleted: C:\Users\All Users\avg web tuneup
Deleted: C:\Users\Sheana\AppData\Local\avg web tuneup


***** [ Files ] *****

Deleted: C:\Users\Sheana\Downloads\ReimageRepair.exe
Deleted: C:\END


***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKLM\SOFTWARE\AVG Tuneup
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Deleted: [Key] - HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
Deleted: [Key] - HKLM\SOFTWARE\Classes\TypeLib\{4BC8AD89-AC5F-4DBD-A38F-C355C7DD33D7}
Deleted: [Key] - HKLM\SOFTWARE\MozillaPlugins\@avg.com\AVG SiteSafety plugin,version=11.0.0.1,application\x-avg-sitesafety-plugin
Deleted: [Key] - HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1907 B] - [2016/8/23 12:1:37]
C:/AdwCleaner/AdwCleaner[S0].txt - [4147 B] - [2016/8/23 11:42:34]
C:/AdwCleaner/AdwCleaner[S1].txt - [1991 B] - [2016/8/23 12:1:23]
C:/AdwCleaner/AdwCleaner[S2].txt - [2629 B] - [2017/11/3 7:48:32]


########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt ##########

By the way, can I "reply" twice in a row, like if I want to add something, I see that it says somewhere in the instructions

for the forum not to do so?

Both programs ran in clean mode with AVG disabled:

MWB:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/3/17
Scan Time: 8:23 AM
Log File: e91e78b5-c067-11e7-a283-00ff70a9d2c9.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3162
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sheana-PC\Sheana

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 336611
Threats Detected: 3
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 11 min, 18 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
PUP.Optional.Proinstall, C:\USERS\SHEANA\DOWNLOADS\SPOTIFYSETUP-39223635.EXE, No Action By User, [5913], [65195],1.0.3162
PUP.Optional.Reimage, C:\USERS\SHEANA\DOWNLOADS\REIMAGEREPAIR.EXE, No Action By User, [1070], [331559],1.0.3162
PUP.Optional.Reimage, C:\USERS\SHEANA\DOWNLOADS\REIMAGEREPAIR(1).EXE, No Action By User, [1070], [331559],1.0.3162

Physical Sector: 0
(No malicious items detected)


(end)

ADWCleaner:

# AdwCleaner 7.0.4.0 - Logfile created on Fri Nov 03 20:57:26 2017
# Updated on 2017/27/10 by Malwarebytes
# Database: 11-03-2017.1
# Running on Windows 7 Home Premium (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1907 B] - [2016/8/23 12:1:37]
C:/AdwCleaner/AdwCleaner[C1].txt - [2542 B] - [2017/11/3 8:4:45]
C:/AdwCleaner/AdwCleaner[C2].txt - [1524 B] - [2017/11/3 8:22:20]
C:/AdwCleaner/AdwCleaner[S0].txt - [4147 B] - [2016/8/23 11:42:34]
C:/AdwCleaner/AdwCleaner[S1].txt - [1991 B] - [2016/8/23 12:1:23]
C:/AdwCleaner/AdwCleaner[S2].txt - [2629 B] - [2017/11/3 7:48:32]
C:/AdwCleaner/AdwCleaner[S3].txt - [1352 B] - [2017/11/3 8:20:44]


########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt ##########

The computer still is very capricious - it often freezes in mid program, don't open Firefox, explorer etc.

Still it's much better. I had a suspicion to Spotify, and wanted to reinstall it, but before it didn't work, now it works,

so progress!

Jens